5 ms·

Intentionally accessing a protected computer system without authorization and obtaining information from it is a federal criminal offense (18 USC 1030 (a)(2)(C)

Intentionally accessing a protected computer system without authorization and obtaining information from it is a federal criminal offense (18 USC 1030 (a)(2)(C)).

stass 10y ago
They didn't access any Lyft systems. They ran Lyft software on their own devices and collected and analyzed the data Lyft provides. One can argue that they broke EULA, but it's not necessarily unethical, and I'm ready to bet the majority of this site users broke at least one software EULA in their lifetime.
- tuyguntn 10y ago
  Assuming they did like you said the main point is > collected and analyzed the data Lyft provides they did it without permission
  - deleted 10y ago
    [deleted]
- pluma 10y ago
  Sure, the fake accounts just violated the ToS. But they then used an enumeration attack to find existing accounts and retrieve information not intended to be available to them. That it's not technologically sophisticated doesn't mean it's not a criminal offense. If someone doesn't lock their front door and you enter their building, you're still trespassing. Especially if it's your competitor's front door and you're repeatedly entering the building to scout the place out for financial gain.
  - nikcub 10y ago
    I don't use any service without having a basic understanding oh how secure and private their systems are - the CFAA makes that all illegal "You wouldn't open an unlocked door" is the "you wouldn't download a car" of infosec. The later redefined theft as not requiring anybody to be deprived of a good while the former has the same flaw, you arent deprived of any good, you aren't harmed, you haven't been coerced or forced - i.e. It meets none of the common law definitions of trespass[0] [0] but it does explain why ddos attacks, spam and stealing user data are trespass because they do meet those definitions
    - pluma 10y ago
      FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. There's a difference between "opening an unlocked door" and opening it, walking through it, making notes of everything behind it and repeating this room for all the other unlocked doors and then doing that pretty much continuously for days, weeks, months or however long Uber did it.
      - nikcub 10y ago
        My point was that walking through an unlocked door is a terrible analogy for accessing a resource URI that isn't directly linked from a page
      - pdpi 10y ago
        > FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. I would totally open an unmarked unlocked door in a public space that has locked doors clearly marked "restricted access", especially if the layout of the place I'm visiting suggests that there would be something interesting there. That's pretty much what it boils down to, no? Just because you didn't document an endpoint doesn't necessarily mean it's restricted access. In fact, if the end point is accessible, and you have other sections of your service that require authentication, then it's very much the exception that proves the rule — the fact that you specifically forbid access to some routes reasonably means that, in general, I'm allowed access to unauthenticated endpoints.
    - UncleMeat 10y ago
      Enumeration attacks are clearly covered by CFAA based on current law. See weev for example.
nikcub 10y ago
The part of CFAA that classified breaking a EULA or Terms of Service as unauthorized access is a horrible law that is frequently abused (most famously Aaron Swartz) It is rightfully broadly criticized, and that shouldn't change because Uber are the perpetrators here
- foldr 10y ago
  Just because you like Aaron Swartz doesn't mean that the law was 'abused'. He flagrantly violated MIT's terms of service and knew that he was doing so.
  - nikcub 10y ago
    > He flagrantly violated MIT's terms of service and knew that he was doing so. Yep and that shouldn't be a federal offense with ~20 year jail term with a lifetime criminal record It's private companies defining federal law and dictating enforcement for their own purposes. You wouldn't let Wal-Mart define what it's own tax laws are, or have McDonalds define what RICO is - having companies define what theft or trespass are is just as absurd. edit: the list of notable CFAA cases reads like a tragic comedy[0] There is a case in there where someone was charged for encouraging his union members to email complaints to a company and when it crashed their mail server he was charged under the CFAA. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#Notable_cases_and_decisions_referring_to_the_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#N...
    - foldr 10y ago
      The sentencing is up to the judge, not the law. Swartz was never sentenced to anything. You are getting the 20 year figure from media outlets that added up the maximum possible sentences for everything he was charged with, which bears no relation to how sentencing actually works. Also, it obviously has to be a federal offense, since wires cross state lines.
      - nikcub 10y ago
        > The sentencing is up to the judge With 97% of federal cases ending in plea agreements sentencing is overwealmingly in the hands of prosecutors. In the Swartz case she wanted him to plead guilty to every single charge and serve up to 6 years. Hence the suicide. As leverage in negotiations they told him at trial he was facing up to 35.
a_imho 10y ago
http://blog.erratasec.com/2012/11/you-are-committing-crime-right-now.html http://blog.erratasec.com/2012/11/you-are-committing-crime-r...
bitexploder 10y ago
Not saying I agree with parent or not, but he asked what was unethical, not about the legality. I do not base my ethics on the law.
prostoalex 10y ago
A protected computer system. The Information article suggests that driver IDs were available in the clear to anyone who'd bother looking at API payloads.

Intentionally accessing a protected computer system without authorization and obtaining information from it is a federal criminal offense (18 USC 1030 (a)(2)(C)).

stass 10y ago

They didn't access any Lyft systems. They ran Lyft software on their own devices and collected and analyzed the data Lyft provides. One can argue that they broke EULA, but it's not necessarily unethical, and I'm ready to bet the majority of this site users broke at least one software EULA in their lifetime.

tuyguntn 10y ago
Assuming they did like you said the main point is > collected and analyzed the data Lyft provides they did it without permission
- deleted 10y ago
  [deleted]
pluma 10y ago
Sure, the fake accounts just violated the ToS. But they then used an enumeration attack to find existing accounts and retrieve information not intended to be available to them. That it's not technologically sophisticated doesn't mean it's not a criminal offense. If someone doesn't lock their front door and you enter their building, you're still trespassing. Especially if it's your competitor's front door and you're repeatedly entering the building to scout the place out for financial gain.
- nikcub 10y ago
  I don't use any service without having a basic understanding oh how secure and private their systems are - the CFAA makes that all illegal "You wouldn't open an unlocked door" is the "you wouldn't download a car" of infosec. The later redefined theft as not requiring anybody to be deprived of a good while the former has the same flaw, you arent deprived of any good, you aren't harmed, you haven't been coerced or forced - i.e. It meets none of the common law definitions of trespass[0] [0] but it does explain why ddos attacks, spam and stealing user data are trespass because they do meet those definitions
  - pluma 10y ago
    FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. There's a difference between "opening an unlocked door" and opening it, walking through it, making notes of everything behind it and repeating this room for all the other unlocked doors and then doing that pretty much continuously for days, weeks, months or however long Uber did it.
    - nikcub 10y ago
      My point was that walking through an unlocked door is a terrible analogy for accessing a resource URI that isn't directly linked from a page
    - pdpi 10y ago
      > FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. I would totally open an unmarked unlocked door in a public space that has locked doors clearly marked "restricted access", especially if the layout of the place I'm visiting suggests that there would be something interesting there. That's pretty much what it boils down to, no? Just because you didn't document an endpoint doesn't necessarily mean it's restricted access. In fact, if the end point is accessible, and you have other sections of your service that require authentication, then it's very much the exception that proves the rule — the fact that you specifically forbid access to some routes reasonably means that, in general, I'm allowed access to unauthenticated endpoints.
  - UncleMeat 10y ago
    Enumeration attacks are clearly covered by CFAA based on current law. See weev for example.

nikcub 10y ago

The part of CFAA that classified breaking a EULA or Terms of Service as unauthorized access is a horrible law that is frequently abused (most famously Aaron Swartz) It is rightfully broadly criticized, and that shouldn't change because Uber are the perpetrators here

foldr 10y ago
Just because you like Aaron Swartz doesn't mean that the law was 'abused'. He flagrantly violated MIT's terms of service and knew that he was doing so.
- nikcub 10y ago
  > He flagrantly violated MIT's terms of service and knew that he was doing so. Yep and that shouldn't be a federal offense with ~20 year jail term with a lifetime criminal record It's private companies defining federal law and dictating enforcement for their own purposes. You wouldn't let Wal-Mart define what it's own tax laws are, or have McDonalds define what RICO is - having companies define what theft or trespass are is just as absurd. edit: the list of notable CFAA cases reads like a tragic comedy[0] There is a case in there where someone was charged for encouraging his union members to email complaints to a company and when it crashed their mail server he was charged under the CFAA. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#Notable_cases_and_decisions_referring_to_the_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#N...
  - foldr 10y ago
    The sentencing is up to the judge, not the law. Swartz was never sentenced to anything. You are getting the 20 year figure from media outlets that added up the maximum possible sentences for everything he was charged with, which bears no relation to how sentencing actually works. Also, it obviously has to be a federal offense, since wires cross state lines.
    - nikcub 10y ago
      > The sentencing is up to the judge With 97% of federal cases ending in plea agreements sentencing is overwealmingly in the hands of prosecutors. In the Swartz case she wanted him to plead guilty to every single charge and serve up to 6 years. Hence the suicide. As leverage in negotiations they told him at trial he was facing up to 35.

a_imho 10y ago

http://blog.erratasec.com/2012/11/you-are-committing-crime-right-now.html http://blog.erratasec.com/2012/11/you-are-committing-crime-r...

bitexploder 10y ago

Not saying I agree with parent or not, but he asked what was unethical, not about the legality. I do not base my ethics on the law.

prostoalex 10y ago

A protected computer system. The Information article suggests that driver IDs were available in the clear to anyone who'd bother looking at API payloads.